Data controller
Name: Oral Hammaslääkärit Ltd
Business ID: 2863321-3
Postal and street address: Linnoitustie 6 B, FI-02600 Espoo, Finland
Telephone: +358 (0)10 400 3010 (switchboard)
Contact person in matters concerning the register
Name: Sanna Elomaa
Email: tietosuojavastaava@oral.fi
Name of the register
Oral Group’s marketing register
Legal basis for the pro-cessing of personal data
The processing of personal data is based on Oral’s legitimate interest (for example, direct marketing) and the consent given by the data subject (for example, electronic direct marketing).
Purpose of the processing of personal data
Personal data in the register is processed for the following purposes:
• direct marketing
• performing opinion and marketing surveys
• arranging marketing competitions and prize draws
• planning and developing Oral’s business operations and services
Categories of data subjects
Potential consumer customers
Data content of the register
The register contains the following personal data:
• name
• contact details (postal address, email address and telephone number)
• title or profession
• age or year of birth
• sex
• native language
• a maximum of one additional identifier concerning the data subject
• the methods of communication preferred by the data subject
• consents and prohibitions regarding direct marketing
• data concerning marketing and sales promotions (for example, marketing efforts targeted to the data subject)
• possible additional data collected with the data subject’s consent
Regular sources of the register’s data
The data is primarily retrieved directly from the data subject, for example, upon subscribing to Oral’s newsletter or participating in marketing competitions and prize draws.
Personal data can also be collected from and updated by means of publicly available data sources such as public and private registers (for example, the Population Register Centre).
Data from Oral’s customer register may be transferred to the marketing register after the termination of the relevant connection (i.e., after the termination of an active customer relationship).
Regular disclosure of data
The personal data is not regularly disclosed to third parties.
Oral may use external service providers to perform tasks related, for example, to marketing. In these cases, Oral is committed to ensuring that the service provider shall process the personal data only to the extent necessary for the purposes of providing the service.
Transfer of data outside the EU or EEA
The personal data is not transferred outside the European Union or the European Economic Area.
Principles of register protection
The register’s data is stored in data systems that use technical and programmatic measures to ensure a sufficient level of data security. Each per-son using the register has a personal user ID and password to access the system. Only designated people have access to the data in the register to the extent necessary for the purposes of performing their tasks.
Data retention period
The personal data in the register is retained permanently to the extent allowed by law. Oral shall regularly assess the necessity of retaining the data and Oral shall take care of such reasonable measures to ensure that no personal data related to the data subjects that are obsolete, inaccurate or incompatible with the purpose of the processing of the personal data are stored in the register.
Rights of the data subject:
Right of access
A data subject has the right to inspect what personal data on him/her has been stored in Oral’s marketing register. The inspection request must be submitted to the contact person of the register in writing.
Right to request the rectification of data
A data subject has the right to request the rectification of inaccurate or incomplete personal data concerning him/her. The rectification request must be submitted to the contact person of the register in writing.
Right to request the erasure of data
A data subject has the right to request the erasure of personal data concerning him/her in the register unless there is a legal basis for the retention of the data. The erasure request must be submitted to the contact person of the register in writing.
Right to request the restriction of the processing of personal data and the right to object to the processing of personal data
A data subject has the right to request the restriction of and to object to the processing of his/her personal data. The restriction request and objection concerning the processing of personal data must be submitted to the con-tact person of the register in writing.
Right to withdraw consent regarding the processing of personal data
If the processing of personal data is based on the data subject’s consent, the data subject has the right at any time to withdraw his/her consent regarding the processing of personal data. The consent can be withdrawn by submitting a written request to the contact person of the register.
Right to prohibit using personal data for the purposes of direct marketing
A data subject has the right to prohibit using personal data concerning his/her for the purposes of direct marketing and marketing or opinion surveys. Such prohibition may be given, for example, by unsubscribing from the mailing list according to the instructions provided in our marketing e-mails or by submitting a written request to the contact person of the register.
Right to prohibit profiling
A data subject has the right at any time to prohibit using personal data concerning him/her for the purposes of profiling. Such prohibition may be given by submitting a written request to the contact person of the register.
Right to data portability
To the extent the data has been provided directly by the data subject and the processing thereof is based on the data subject’s consent, the data subject has the right to acquire such information in a machine-readable form and the right to transmit this data to another controller. This can be per-formed by contacting the contact person of the register in writing.
Right to lodge a complaint to the supervisory authority
A data subject has the right to lodge a complaint concerning failures in the processing of personal data to the supervisory authority (Data Protection Ombudsman).
Updated: 1 June 2022